Skip to content

[Fuzzing] [adamsitnik] [NRBF] Fix bugs discovered by the fuzzer #636

Open
@MihuBot

Description

@MihuBot

Job completed in 44 minutes 54 seconds.
dotnet/runtime#107368

// NrbfDecoderFuzzer
System.ArgumentException: The output char buffer is too small to contain the decoded characters, encoding codepage '65001' and fallback 'System.Text.DecoderExceptionFallback'. (Parameter 'chars')
   at System.Text.Encoding.ThrowCharsOverflow(DecoderNLS decoder, Boolean nothingDecoded)
   at System.Text.DecoderNLS.DrainLeftoverDataForGetChars(ReadOnlySpan`1 bytes, Span`1 chars, Int32& bytesConsumed)
   at System.Text.Encoding.GetCharsWithFallback(Byte* pOriginalBytes, Int32 originalByteCount, Char* pOriginalChars, Int32 originalCharCount, Int32 bytesConsumedSoFar, Int32 charsWrittenSoFar, DecoderNLS decoder)
   at System.Text.Encoding.GetChars(Byte* pBytes, Int32 byteCount, Char* pChars, Int32 charCount, DecoderNLS decoder)
   at System.IO.BinaryReader.Read()
   at System.IO.BinaryReader.ReadChar()
   at System.Formats.Nrbf.Utils.BinaryReaderExtensions.ReadPrimitiveValue(BinaryReader reader, PrimitiveType primitiveType)
   at System.Formats.Nrbf.NrbfDecoder.Decode(BinaryReader reader, PayloadOptions options, IReadOnlyDictionary`2& readOnlyRecordMap)
   at System.Formats.Nrbf.NrbfDecoder.Decode(Stream payload, IReadOnlyDictionary`2& recordMap, PayloadOptions options, Boolean leaveOpen)
   at DotnetFuzzing.Fuzzers.NrbfDecoderFuzzer.Test(Span`1 testSpan, MemoryStream stream) in D:\runner-dir\runtime\src\libraries\Fuzzing\DotnetFuzzing\Fuzzers\NrbfDecoderFuzzer.cs:line 36
   at DotnetFuzzing.Fuzzers.NrbfDecoderFuzzer.FuzzTarget(ReadOnlySpan`1 bytes) in D:\runner-dir\runtime\src\libraries\Fuzzing\DotnetFuzzing\Fuzzers\NrbfDecoderFuzzer.cs:line 26
   at SharpFuzz.Fuzzer.LibFuzzer.Run(ReadOnlySpanAction action, Boolean ignoreExceptions)
==5504== ERROR: libFuzzer: deadly signal
NOTE: libFuzzer has rudimentary signal handlers.
      Combine libFuzzer with AddressSanitizer or similar for better crash reports.
SUMMARY: libFuzzer: deadly signal
MS: 2 InsertByte-InsertRepeatedBytes-; base unit: b2b49562056a89e3cc3139d38dd5fc79054b1d01
0x0,0x1,0x0,0x0,0x41,0xff,0xff,0xff,0xff,0x1,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x7,0x1,0x17,0x0,0x0,0x0,0x1,0x0,0x0,0x0,0x0,0x0,0xa,0x1,0x0,0x3,0x3,0x3,0x3,0x3,0x3,0x3,0x3,0x3,0x3,0xf3,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0xbf,0x3,0x10,0x0,0x0,0x0,0x0,0x0,
\000\001\000\000A\377\377\377\377\001\000\000\000\000\000\000\000\007\001\027\000\000\000\001\000\000\000\000\000\012\001\000\003\003\003\003\003\003\003\003\003\003\363\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\277\003\020\000\000\000\000\000
artifact_prefix='./'; Test unit written to NrbfDecoderFuzzer-artifact-2
Base64: AAEAAEH/////AQAAAAAAAAAHARcAAAABAAAAAAAKAQADAwMDAwMDAwMD87+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/vwMQAAAAAAA=

Artifacts:

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions